General

  • Target

    3ef69bc15c873314c4924b4bf5fdf8a3838dfdbacc85e2c2b4bc4d4e4855b176

  • Size

    254KB

  • Sample

    220701-ekmqksbbdp

  • MD5

    684bce6aaff709c40838936e89d76b76

  • SHA1

    d92b4647750fd8ba3d423e2424ca8048a77acbcb

  • SHA256

    3ef69bc15c873314c4924b4bf5fdf8a3838dfdbacc85e2c2b4bc4d4e4855b176

  • SHA512

    1d9faffd7eeac932650a5af1123341e957307947bc028ae842c2efeb9b203bb9d1907690b907674bd92dbbc1860057456707e7cceb35d93c0de6932e64fe9db4

Malware Config

Extracted

Family

emotet

Botnet

Epoch2

C2

94.205.247.10:80

86.22.221.170:80

85.25.255.207:8080

185.94.252.13:443

94.177.216.217:8080

62.75.187.192:8080

78.24.219.147:8080

91.205.215.66:8080

24.45.195.162:7080

94.192.225.46:80

200.113.106.18:21

186.4.172.5:8080

104.131.44.150:8080

67.225.229.55:8080

190.226.44.20:21

92.233.128.13:143

5.196.74.210:8080

185.187.198.15:80

87.230.19.21:8080

186.176.138.171:7080

rsa_pubkey.plain

Targets

    • Target

      3ef69bc15c873314c4924b4bf5fdf8a3838dfdbacc85e2c2b4bc4d4e4855b176

    • Size

      254KB

    • MD5

      684bce6aaff709c40838936e89d76b76

    • SHA1

      d92b4647750fd8ba3d423e2424ca8048a77acbcb

    • SHA256

      3ef69bc15c873314c4924b4bf5fdf8a3838dfdbacc85e2c2b4bc4d4e4855b176

    • SHA512

      1d9faffd7eeac932650a5af1123341e957307947bc028ae842c2efeb9b203bb9d1907690b907674bd92dbbc1860057456707e7cceb35d93c0de6932e64fe9db4

    • Emotet

      Emotet is a trojan that is primarily spread through spam emails.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Discovery

System Information Discovery

1
T1082

Tasks